wpengine wpgraphql vulnerabilities

Latest wpengine wpgraphql CVEs

Newest publication first

1. CVE-2022-1563 WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure

   Published 2024-01-16

   Medium·CVSS 5.3 EPSS 0.72%

   The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.

2. CVE-2023-23684 WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

   Published 2023-11-13

   Medium·CVSS 6.5 EPSS 0.45%

   Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

3. CVE-2019-9881 WPGraphQL <= 0.2.3 - Unauthenticated Comment Creation

   Published 2019-06-10

   Medium·CVSS 5.3 EPSS 18.4% Public exploit

   The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.

4. CVE-2019-9880 WPGraphQL <= 0.2.3 - Information Exposure

   Published 2019-06-10

   Critical·CVSS 9.1 EPSS 34.8% Public exploit

   An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.

5. CVE-2019-9879 WPGraphQL <= 0.2.3 - Administrative User Creation

   Published 2019-06-10

   Critical·CVSS 9.8 EPSS 45.7% Public exploit

   The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.